# Set up multisig



Production releases are gated by a **multisig** drive—a [Hypercore](/p2p/reference/building-blocks/hypercore) whose write access is controlled by a quorum of signing keys instead of one machine's private key. This is what removes the single point of failure from a typical desktop release flow, and it is why a multisig drive is **not** machine-bound: a quorum of signers can keep producing releases even if every other key is lost.

This guide is the **one-time setup**. Once it is done, every release uses the repeatable signing flow in [Sign with multisig](/pear/how-to/operate-an-app/multisig/sign-with-multisig).

<Callout type="info">
  This is the production gate of the desktop release flow. You need a working [provision link](/pear/how-to/operate-an-app/manual-deployment/deployment#6-provision) before you set up multisig—provision is the source drive that signing requests are prepared and committed against.
</Callout>

<Callout type="info">
  **Need the `pear` CLI?** Install it from **[install.pears.com](https://install.pears.com)**, or prefix any command below with `npx`. See [Install & upgrade](/pear/reference/pear/cli#install) for details.
</Callout>

## Create signing keys [#create-signing-keys]

Every signer generates a signing key with Pear:

```sh skip="release-flow"
pear multisig keys get
```

On first run this prompts for a password to encrypt the new private key (it errors if none is supplied), then prints the key name and its public key; the keypair is stored under `~/.pear`. `pear multisig keys get` is idempotent—running it again just reprints the existing public key. Each signer takes note of the printed public key and shares it with whoever is assembling the multisig config. The same key can sign many builds.

## Create the multisig config [#create-the-multisig-config]

In your project—the same directory as `package.json`—create or edit `pear.json` and set the `multisig` property to an object with every signer's public key, a `quorum` count, and an arbitrary `namespace` string:

```json skip="release-flow"
{
  "multisig": {
    "publicKeys": ["pubkey-signer-1", "pubkey-signer-2", "pubkey-signer-3"],
    "namespace": "pear-chat",
    "quorum": 2
  }
}
```

This example needs two of three signers to release. The `quorum` is the minimum number of signers whose responses must agree before a release can be committed. The multisig link is derived from the `namespace`, `publicKeys`, and `quorum` alone—the provision (source) link is not part of the config; it is supplied later, when you prepare and commit each signing request.

## Set upgrade to the multisig link [#set-upgrade-to-the-multisig-link]

From the same directory, compute the multisig link:

```sh skip="release-flow"
pear multisig link
# pear://69qwbihxj4c8te15wt3skj4j1g3ufmbo3mperedjqr1hb55mspoo
```

Then finish the release cycle:

1. [Set the upgrade link](/pear/how-to/operate-an-app/manual-deployment/deployment#1-set-the-upgrade-link) in `package.json` to the multisig link from above.
2. [Bump `version`](/pear/how-to/operate-an-app/manual-deployment/deployment#2-version).
3. Run [`npm run make`](/pear/how-to/operate-an-app/manual-deployment/deployment#3-make-distributables), [`pear build`](/pear/how-to/operate-an-app/manual-deployment/deployment#4-build-the-deployment-directory), and [`pear stage`](/pear/how-to/operate-an-app/manual-deployment/deployment#5-stage).
4. [Provision](/pear/how-to/operate-an-app/manual-deployment/deployment#6-provision) again with the multisig link as the third argument:

```sh skip="release-flow"
pear provision pear://0.1082.qxenz5wmspmryjc13m9yzsqj1conqotn8fb4ocbufwtz9mtbqq5o pear://q9sopzoqgas9usoiq7uzkkwngm5pzj4zo3n4esjwwbmw6offis8o pear://0.0.69qwbihxj4c8te15wt3skj4j1g3ufmbo3mperedjqr1hb55mspoo
```

The provision drive's `upgrade` field now points at the multisig drive. Setup is complete—releases now go through the signing flow.

## See also [#see-also]

* [Sign with multisig](/pear/how-to/operate-an-app/multisig/sign-with-multisig)—the repeatable prepare → sign → verify → commit flow for every release.
* [Troubleshoot multisig](/pear/how-to/operate-an-app/multisig/troubleshoot-multisig)—interrupted commits, `INCOMPATIBLE_SOURCE_AND_TARGET`, and recovering lost write access.
* [Deploy your application](/pear/how-to/operate-an-app/manual-deployment/deployment)—the full eight-step release flow this gates.
* [Release pipeline](/pear/explanation/deployment-releasing-apps-p2p)—conceptual diagrams for stage, provision, and multisig.